一个本地 MCP 服务器，让 AI 代理能够检查和编辑你的个人 Power Automate 云流——使用你自己的 Microsoft 账户进行身份验证，无需管理员同意，也无需付费订阅。
它的存在是因为托管替代方案每月收费来包装一个 Microsoft 已经免费向你的账户开放的 API——而且因为当你更愿意描述变更并让代理在护栏下应用它时，Power Automate 门户是一个糟糕的界面。这个仓库是对该 API 实际工作原理进行逆向工程后的记录，打包成一个可用的工具。
个人项目，按原样提供。 在依赖它之前，请阅读可靠性说明和docs/SECURITY.md。
与 Microsoft 无关联，也未获得其认可。
每个“从代码管理 Power Automate”的教程都告诉你要在 Entra ID 中注册一个应用，并让管理员同意 Dynamics CRM user_impersonation 或 Flows.Manage.All。在锁定严格的企业租户中，这个请求是行不通的——它会授予一个常驻服务主体，而管理员（合理地）会拒绝。
这个项目通过使用一个 Microsoft 为交互式工具提供的公共第一方客户端 ID 完全绕过了这一点：
51f81489-12ee-4a9e-aaae-a2591f45987d ("Dynamics 365 Example Client", of XrmToolBox fame)通过 OAuth 2.0 设备代码授权驱动，这是一种委派登录：令牌携带你的身份和你的权限，没有服务主体需要任何人批准，也不会出现同意屏幕。你可以从笔记本电脑上以你在门户中已有的完全相同的权限与 Power Automate 通信——不多不少。
令牌受众有一个值得记录的非显而易见的怪癖：
https://service.flow.microsoft.com//user_impersonation
^^ two slashes, on purpose旧版资源 URI 以斜杠结尾，而 v2 作用域语法会追加 /user_impersonation，从而产生双斜杠。某些租户会拒绝单斜杠形式。这一个字符串就是成功登录和晦涩的 AADSTS 错误之间的区别。
Related MCP server: MCP Power Automate
有两个 REST 后端，它们不可互换：
|
| |
状态 | 未记录，不受支持 | 官方，已记录（ |
能看到个人流 | 能 | 不能——没有 Dataverse 就返回 404 |
能看到解决方案流 | 能 | 能 |
我们用它做什么 | 一切（个人流） | 已接入，处于休眠状态 |
花费最多研究时间的教训是：受支持的 API 根本无法看到个人流。它要求流存在于 Dataverse 解决方案中。因此，任何管理普通用户在门户中创建的流的工具——包括每个付费 MCP——都别无选择，只能依赖不受支持的服务 API。这个项目明确地做出了这个权衡，而不是隐藏它。
src/client/flow-api.ts 将两个基础 URL 放在一个开关后面，因此一个后来移入解决方案的流（或者服务 API 最终崩溃的未来）只需更改一个常量，而不是重写。
api.flow.microsoft.com 未记录且不受 Microsoft 支持。它可能在没有通知的情况下改变形态或消失，而这个工具届时会崩溃。这个风险正是付费服务收费替你承担的部分。对于一个你自己修复问题的个人工具来说，这是一个不错的权衡。对于任何承载关键任务的东西来说，则不是。请酌情选择。
一切都以你的身份运行。如果你失去了对账户的访问权限，工具就会停止工作——背后没有服务身份。
要求：Node 18+（用于内置的 fetch）和 pnpm。一个可以使用 Power Automate 的 Microsoft 工作或学校账户——仅此而已。
git clone https://github.com/karenrebecag/PowerAutomate_MCP.git
cd PowerAutomate_MCP
pnpm install
pnpm build没有需要编辑的配置文件，也没有需要粘贴的密钥。身份验证是针对你自己的 Microsoft 账户的交互式设备代码登录：
pnpm login它会打印一个 URL 和一个短代码：
Power Automate MCP — sign in
1. Open: https://microsoft.com/devicelogin
2. Code: ABCD-EFGH
Waiting for you to finish signing in...打开 URL，输入代码，使用你想要管理其流的账户登录，然后批准。成功后，一个刷新令牌会被写入 .pa-token（权限 0600，已被 gitignore）。服务器会自动从中生成短期访问令牌——在它过期之前（约 90 天不活动）你不会再被询问。要切换账户或从过期令牌中恢复，只需重新运行 pnpm login。
可选环境变量
变量 | 默认值 | 何时设置 |
|
| 如果你的账户属于多个租户，请固定特定的租户 GUID。 |
| 包旁边的 | 将刷新令牌存储在其他位置。 |
pnpm probe 运行阶段 0——它针对你的租户调用每个读取端点，并将真实响应转储到 scratch/（已被 gitignore）。如果某个路由在你的环境中返回 404，你会在这里看到，而不是在使用过程中才发现。它所做的任何事情都不会写入。
pnpm probe将服务器添加到你的客户端配置中。对于 Claude Code，那是 ~/.mcp.json：
{
"mcpServers": {
"power-automate": {
"command": "node",
"args": ["/absolute/path/to/PowerAutomate_MCP/dist/index.js"]
}
}
}使用 dist/index.js 的绝对路径。服务器会相对于自身位置找到 .pa-token，因此无需在客户端中设置工作目录或环境变量。重启客户端（或重新连接服务器），七个工具就会出现。从终端快速检查而不使用客户端：
printf '%s\n%s\n%s\n' \
'{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"c","version":"1"}}}' \
'{"jsonrpc":"2.0","method":"notifications/initialized"}' \
'{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}' \
| node dist/index.js工具 | 写入？ | 功能 |
| 否 | 账户可以看到的每个环境。从这里开始获取环境 ID。 |
| 否 | 环境中的云流（摘要字段）。 |
| 否 | 完整的可编辑定义 + 连接引用。 |
| 否 | 最近的运行历史：状态、代码、时间。 |
| 否 | 一次运行的逐操作分解；跟随失败操作的输入/输出链接。调试视图。 |
| 是 | 启动 / 停止流。除非你传递 |
| 是 | 从定义对象创建或编辑流。 |
检查 / 调试失败
list_environments
list_flows(environmentId)
get_flow_runs(environmentId, flowId)
get_run_actions(environmentId, flowId, runName) → see which action failed安全地更改定义
get_flow(environmentId, flowId) → copy properties.definition
… edit the definition object …
create_or_update_flow(..., dryRun: true) → default; shows wouldSend
create_or_update_flow(..., dryRun: false) → only after explicit OK两个写入工具都拒绝在您明确选择加入（dryRun: false / confirm: true）之前修改任何内容。请将此视为一个功能，而不是麻烦——一个糟糕的定义就可能破坏一个实时自动化。
你： 为什么“通知销售新线索”今天早上失败了？
代理： (list_environments → list_flows → get_flow_runs → get_run_actions) 09:14 的运行在操作
HTTP_To_CRM上以 401 失败。令牌连接引用仍然存在于流上；下游 API 拒绝了调用。你： 在我们修复连接之前关闭这个流。
代理： (set_flow_state 预览 → 在你批准后 confirm: true) 流已停止。
你永远不会为这个循环打开 Power Automate 设计器。代理使用你在门户中已有的相同权限。
src/
auth/ device-code login + silent refresh (the interesting bit)
client/ thin HTTP wrapper over the two REST backends
core/ shared MCP result helpers
tools/ one file per MCP tool (added after Phase 0 confirms shapes)
server.ts MCP server wiring
index.ts stdio transport entry point
scripts/
probe-endpoints.ts Phase 0 reconnaissance — run before trusting any tool
docs/
SECURITY.md tokens, disk artifacts, blast radius
DEVELOPMENT.md how to extend tools without guessing routes阶段 0 — pnpm probe 在实时租户上访问读取路由，并将真实 JSON 保存在 scratch/ 下（已被 gitignore）。
工具仅针对这些形状进行类型化和实现。
返回 404 或看起来错误的路由会被丢弃（例如，独立的 list_connections 不在 v1 中；引用仍然出现在 get_flow 上）。
写入操作带有预览默认值，因此代理无法在第一次尝试时意外应用定义。
可用。七个工具（五个读取，两个写入），每个都根据阶段 0 在实时租户上捕获的响应进行塑造。pnpm verify（类型检查 + lint + 格式 + 测试）是本地门禁。
v1 中不包含： 删除流、桌面流、租户管理员 API、独立连接列表。
文档 | 内容 |
令牌文件、委派爆炸半径、什么不该提交 | |
探测优先的工作流程、脚本、添加工具 | |
在此仓库中工作的编码代理的硬性规则 |
MIT。个人、教育性逆向工程项目。分享出来是为了让其他人了解这个 API 的工作原理，并在此基础上构建自己的个人工具。请在你自己的账户和组织政策范围内使用。
与 Microsoft 无关联，也未获得其认可。
Create a new flow or update an existing one from a definition object. dryRun is the default — pass dryRun:false to actually write. Get the definition shape from get_flow.
| Name | Required | Description | Default |
|---|---|---|---|
| dryRun | No | Default true — preview only. Pass false to actually write. | |
| flowId | No | Flow ID to update. Omit to CREATE a new flow. | |
| definition | Yes | The workflow definition object (properties.definition from get_flow). | |
| displayName | No | Display name. Required when creating. | |
| environmentId | Yes | Environment ID. | |
| connectionReferences | No | Connection references map (properties.connectionReferences from get_flow). |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate readOnlyHint=false, so a write is expected, but the description adds a crucial behavioral detail—the write is skipped by default and only happens when dryRun:false is passed. It does not disclose overwrite semantics or potential side effects beyond those annotations, but the default behavior is important and clearly stated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no wasted words. The main operation is front-loaded, and the dryRun default and definition source reference are compactly included.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a create-or-update tool with no output schema, the description covers the essential action, the write-default safety mechanism, and how to obtain the definition shape. It does not explicitly explain update-discovery behavior and id handling, but those are largely covered by parameter schema and the description as a whole is sufficient for basic usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the description does not need to restate parameter meanings. It adds a light mention of dryRun default and references get_flow for the definition shape, both also reflected in the schema, so it provides marginal additional value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description starts with a specific verb and object: 'Create a new flow or update an existing one from a definition object.' It clearly states both the operation and the resource and distinguishes this from get_flow pointing to a definition source.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives clear usage guidance: dry-run is the default and passing dryRun:false performs the actual write, and it directs the user to get_flow for the definition shape. It does not explicitly enumerate alternatives or when not to use this tool, but the context is fairly unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Full flow definition (triggers, actions, parameters) and connection references.
| Name | Required | Description | Default |
|---|---|---|---|
| flowId | Yes | Flow ID (the `name` field from list_flows). | |
| environmentId | Yes | Environment ID. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=true, so the safety profile is covered. The description adds the detail that connection references are included, which is useful, but it does not disclose behavioral details such as response shape, error cases, or whether the flow is executed. This is acceptable given the annotations but not exceptional.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, information-dense sentence that front-loads the core purpose and enumerates the key contents without filler. Every word contributes to the agent's understanding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-by-ID tool, the description adequately covers what the tool returns: full flow definition and connection references. There is no output schema, but the description mitigates this by naming the major response components. It does not mention error behavior or prerequisites, but those are not critical for this low-complexity operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%: both environmentId and flowId are fully documented in the input schema, including the note that flowId corresponds to the name field from list_flows. The description adds no additional parameter-level meaning, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the exact resource and scope: a full flow definition including triggers, actions, parameters, and connection references. This clearly distinguishes the tool from siblings like get_flow_runs and get_run_actions, which focus on runs rather than definitions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'full flow definition' makes the intended use obvious: retrieve the complete definition of one flow rather than a list of flows or run-level data. It does not explicitly name alternatives or list exclusions, but the scope is clear enough for an agent to select it correctly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent run history for a flow: status, code and timing per run.
| Name | Required | Description | Default |
|---|---|---|---|
| top | No | Max runs (default 20). | |
| flowId | Yes | Flow ID. | |
| environmentId | Yes | Environment ID. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and openWorldHint, so the safety profile is covered. The description adds the return fields but does not disclose ordering, freshness, pagination behavior, or any caveats about the returned history.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence states the resource and the key output dimensions without filler. Every word contributes to understanding what the tool does.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only list tool with fully documented parameters, the description is mostly complete. It mentions the key returned aspects, though it could have added ordering or recency behavior; 'Recent' plus the top parameter makes this workable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with flowId, environmentId, and top all individually documented. The description adds no parameter-level meaning beyond restating the general concept, so the schema carries the burden.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description identifies a specific resource (flow run history) and the data it returns (status, code, timing per run). It is clear enough to distinguish from get_flow, though it does not explicitly contrast with the similar sibling get_run_actions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance about when to use this tool versus alternatives like get_flow or get_run_actions, and no mention of prerequisites or context. Usage is only implied by the tool name and the general description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Per-action breakdown of one run — the debugging view. Follows inputs/outputs links for failed actions by default (or a named action, or all).
| Name | Required | Description | Default |
|---|---|---|---|
| runId | Yes | Run ID from get_flow_runs. | |
| flowId | Yes | Flow ID. | |
| includeIO | No | Follow inputs/outputs links for: failed actions (default), all, or none. | |
| actionName | No | Only this action; follows its I/O links. | |
| environmentId | Yes | Environment ID. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover readOnlyHint=true and openWorldHint=true, lowering the burden on the description. The description adds genuinely useful context beyond annotations: the default behavior of following inputs/outputs links for failed actions, which an agent cannot infer from structured data. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tightly written sentences with zero waste. The primary purpose is front-loaded ('Per-action breakdown... debugging view') and the behavioral detail is delivered efficiently in the second sentence.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given a moderate 5-parameter surface with full schema coverage, read-only annotations, and no output schema required, the description explains the purpose and the key default behavior. Nothing essential an agent needs to invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so every parameter (runId, flowId, includeIO, actionName, environmentId) is already documented in the schema. The description's mention of 'failed actions by default (or a named action, or all)' mirrors the includeIO enum already present in the schema, adding little semantic value beyond it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific resource ('per-action breakdown of one run') with an explicit framing ('the debugging view'). It clearly distinguishes itself from siblings like get_flow_runs (which returns the run list) and get_flow (single flow definition) — this tool drills to the action level of one run.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The 'debugging view' label implies when to use it, and the action-level scope contrasts with the run-level siblings. However, no alternative is named explicitly and there's no when-not-to-use guidance, so usage is only implied rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List every Power Platform environment the signed-in account can see.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=true, so safety is covered. The description adds the 'every' and 'signed-in account' scope, which complements the openWorldHint by clarifying the visibility boundary, but does not go into details like pagination or environment properties.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single clear sentence with zero waste; the key scoping ('every', 'signed-in account') is front-loaded. Perfectly sized for a no-parameter list tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is sufficient for a simple list operation, but the lack of an output schema and absence of any mention of return format or filtering capabilities leaves minor gaps. However, given the simplicity, it is adequately complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has 0 parameters; the schema is empty with 100% coverage, so there is nothing to document. The description adds no parameter meaning, but with no params, this is a baseline high score.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool lists every Power Platform environment visible to the signed-in account—a specific verb (list) and resource (environments). It distinguishes from siblings like list_flows which target a different resource type, though it doesn't explicitly name the sibling for comparison.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description and 'signed-in account' context imply it's for browsing available environments, but there is no explicit when-to-use guidance or mention of alternatives among siblings. It's clear enough for obvious cases but lacks explicit routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List cloud flows in an environment (summary fields, not the full definition).
| Name | Required | Description | Default |
|---|---|---|---|
| top | No | Max flows to return. | |
| environmentId | Yes | Environment ID from list_environments. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With readOnlyHint=true in annotations, the read-only nature is already declared; the description adds that the result contains summary fields rather than full flow definitions, which is a meaningful output-behavior disclosure. It does not detail pagination or default limits, but the schema's top parameter covers the limit behavior and no contradictions exist.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with a parenthetical carries the core purpose, scope, and an output caveat with no filler. The actionable verb is front-loaded and every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple, read-only list operation, the description plus schema covers the required environmentId and the optional max count, and the summary-fields caveat gives the agent enough to choose the tool and interpret the response at a high level. There is no output schema, and the description does not enumerate exactly which summary fields are returned or any paging behavior, so a small completeness gap remains.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline applies. The description adds no parameter-level detail beyond the schema, which already explains environmentId as coming from list_environments and top as the max number of flows to return.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('List'), a concrete resource ('cloud flows'), and a scope ('in an environment'), immediately distinguishing it from get_flow, which returns a single flow's full definition. The parenthetical clarifies that output is summary fields, not full definitions, removing ambiguity about its purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly indicates this is the tool to use when you need an inventory/summary of cloud flows within a specific environment, and the 'not the full definition' caveat implies when not to use it. It does not explicitly name a sibling like get_flow as the alternative, so it stops short of full routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Turn a flow on (start) or off (stop). Previews by default; pass confirm:true to apply.
| Name | Required | Description | Default |
|---|---|---|---|
| state | Yes | Turn the flow on (start) or off (stop). | |
| flowId | Yes | Flow ID. | |
| confirm | No | Must be true to actually apply. Omit to preview the intended change. | |
| environmentId | Yes | Environment ID. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description explicitly discloses the critical behavioral gate: it previews by default and only actually mutates state when confirm:true is passed. Given annotations readOnlyHint=false and openWorldHint=true, this adds the key safety-relevant context an agent needs before invoking the tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences with no filler: the primary action is front-loaded, followed by the essential preview/confirm caveat. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is sufficient for a simple four-parameter tool: it states the operation, the states, and the confirmation mechanism. It does not describe what the preview output looks like, but since there is no output schema this is a partial gap rather than a serious omission.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the input schema already documents all parameters, including the meaning of confirm and the start/stop enum. The description adds no new parameter-level information; it merely restates the behavior already captured in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names the action ('Turn a flow on/off'), the resource (flow), and the two valid states (start/stop). This makes it clearly distinct from siblings such as list_flows, get_flow, and create_or_update_flow, which concern discovery, reading, or definition changes rather than operational state.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The usage is implied: invoke this tool when you want to start or stop a flow, and the preview behavior supports a safe exploratory workflow. However, the description does not explicitly name alternatives such as create_or_update_flow for definition changes, nor does it mention when not to use this tool or what prerequisites must exist.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.1.0create_or_update_flowget_flowget_flow_runsget_run_actionslist_environmentslist_flowsset_flow_stateScored across 7 tools
Each tool targets a distinct resource/action combination: environments, flow lists, full flow definitions, run history, per-action run details, flow state, and create/update. No two tools overlap in purpose; an agent can easily select the correct tool for a given task.
The naming follows a clear verb_noun pattern with verbs like list_, get_, set_, and create_or_update_. The only minor inconsistency is the use of both list_ and get_ for read operations, which could cause slight ambiguity (e.g., list_flows vs get_flow), but the distinction between summary and full definition is established in descriptions.
Seven tools is an appropriate, focused set for a Power Automate management server. The scope is clear, and each tool serves a necessary function without redundancy. This size is large enough to be useful yet small enough to avoid confusion.
The toolset covers the main lifecycle operations for flows: listing, retrieving, updating, setting state, and inspecting runs/actions. A notable missing operation is the ability to delete a flow, and there is no explicit way to list all runs across flows, but the core workflows of inspection and modification are well-covered.
MCP server for secureFlows: token-free URL builders and integration-linting tools for AI agents.
Connect any AI agent to 1,000+ apps and 27,000+ actions through one remote MCP server (OAuth).
Zero-setup MCP gateway securely connecting AI to your tools with authentication and workflows
Open-source Zapier/n8n alternative as an MCP server: agents build, run and debug your workflows.